Winweb Security

Winweb Security is a fake antivirus software for Windows system. It will attempt to persuade users into obtaining the registered version by providing fake scan results on victim’s computer. This fake anti-virus software comes from a large group of malicious applications that has created various variants of it.

Winweb Security is just a mimic of the other versions and only obvious change is its name. Graphical user interface and method of propagation remains the same. Usually, users can acquire Winweb Security from web sites that disguise either online virus scanner or one that offers free videos. As for fake online scanner sites, it will automatically run a scan on visitor’s machine. Several threats will be identified on the said scan and prompt user to download Winweb Security as a cleaner. While on bogus video sites, user will receive prompt stating that multimedia player is required to view online movies.

Innocent users may think that the endorsed program will help remove a threat that is why so many have fallen into the trick of Winweb Security. Right after it is installed; it will carry another local scan on the computer and detects dozens of threats. An advice to remove these infections follows but can only be performed if the licensed version of Winweb Security is purchased. Users will be brought to an online payment web site where credit card account is needed to complete the transaction.

Winweb-Security

More Rogue Program Details

Notable files associated with Winweb Security:

c:Documents and SettingsAll UsersApplication DataWinwebSecurityWinwebSecurity.exe
c:Documents and SettingsAll UsersApplication DataWinwebSecurityLanguagesEnglish.lng
c:Documents and SettingsAll UsersApplication DataWinwebSecurityconfig.udb
c:Documents and SettingsAll UsersApplication DataWinwebSecurityinit.udb

Signs and Symptoms of Winweb Security Infection:

Browser is redirected to Winweb Security web sites
Rogue program is coupled with web site that promotes the full version of it. Also, the same web sites are used for online payment if user has fallen into the trap of this malware.

Exhibits fake pop-ups and security alert
In order to deceive computer users, Winweb Security will exhibit a bunch of fake security alerts and warning messages. It also intends to promote the malware as the sole remover for identified threats.

Winweb Security will detect errors and threats that do not exists
Every rogue programs are made to mislead computer users. Thus, expect that Winweb Security will show scan result that is full of errors and threats. This result is fictitious and you should not follow its recommendation.

Other Functions of Winweb Security:

  • Winweb Security may come with another Trojan or virus
  • It can contact a remote server in order to download more malware
  • This threat will drop malicious files and make changes to the system registry
  • Winweb Security can steal credit card information when you pay for it online
  • The threat can redirect search result link to a malicious web page

How to Remove Winweb Security

1. Download Malwarebytes' Anti-Malware from this link and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as default only.

4. Before the installation completes, check on the following prompts:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware

5. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished click on the Show Results button.
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart your computer.

Note: Some malware may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

39 Comments

  1. Amee

    I already tried it and winweb is still on our notebook.
    I’m going to try ExterminateIt. I heard it’s one of the best just a little while ago.

  2. Amee

    RogueRemover didn’t even detect WinWeb.

  3. Amee

    The one I really wanted was NoAdware but I get a blank webpage. Strange. But thanks for help anyway :)

  4. deepak

    well it is very bad to use winweb because it is not removal from computer

  5. T.J

    WOOHOO! i’m clean of the WinWeb!

    thanks so much for all the help ;)

  6. Jowens

    I tried using “Malwarebytes’ Anti-Malware” & “Spyware Doctor” but Win Web Security is still there.

  7. Angela

    I tried all these solutions as well, and none worked.

    I found the application by double clicking the icon in the task bar and opening task manager.

    I selected the WinWeb Security and go to process.

    The process masqueraded itself as 260620102.exe
    I killed the process and did a registry search for that value as well as a full computer search.

    I found 3 registry keys and one file in C:Windowsprefetch

    removing all entries resolved issue.

  8. Naidu

    I solved the problem.
    Its simple, I tried all tools with no + result. So I tried with what Angela suggested.

    Only diff i found is the process in my system is 665648920.exe
    first kill such numbered process and search entire computer with same name (665648920.exe in my case)..delete the found things and restart…

    Thank you Angela….
    Cheers Naidu.

  9. Steve

    I keep getting the pop ups, about every 20 seconds telling me to download winweb security but I haven’t downloaded it. Yet the pop ups continue and these pop ups have taken over my internet explorer and won’t let me upgrade any spyware products or go to a restore point. I’ve tried Adaware and Spy doctor and they didn’t stop these pop ups. Also, since I never clicked on pop ups there is no trace of win web security in my task manager or in my registry or any folders. Any suggestions?

  10. Melissa

    I see everyone seems to have a different number in the process. Did everyone get a message when selecting the “end process” a warning about undesirable actions if I continue to do so??? I believe I found it in the process, but scared to remove it due to message lol.

  11. Melissa

    How do you do a registry search to find the number the WinWeb is masquerading as???

  12. Melissa

    Also I found in my process 586173580.exe, but when I select “end process” I get a warning may have “undesirable results” which is actually funny because this darn program is VERY undesirable LOL. So anyways is everyone getting the same warning????

  13. Melissa

    Angela and Naidu my hat off to both of you. YOU 2 have been more help to me than the entire internet AND Norton which I spent over an hour on the phone with and was going to cost me $100. THANK YOU SOOOO MUCH!!!!!

  14. CW

    I deleted the nasty application, but it was somewhere within my browser. Everytime I tried to go to a reputable anti-virus website (McAfee, Norton, etc) or conduct a search on McAfee, it killed my browser. I eventually got the blue screen of death and had to do a system restore to get rid of it 100%. Now my McAfee works fine.

  15. Brayo

    I am the happiest man ever. Thanks to Angela and Naidu, 4 u have solved my problem. I have searched 4 solutions but all in vain. But the moment I tried out your suggestion it worked instantly. You 2 are genious. Cheers.

  16. rob

    thanks angela winweb was hiding as 777779292.exe in my computer files i deleated them all

  17. bones22j

    Angela I could kiss you right now!!!!!! Same exact story, i had the winweb couldnt get rid of it. i tryed EVERYTHING I could think of including combofix, superantispyware, avast, and the list (believe it or not) goes on. I did everything Angela said and it worked. I did the registry search killed the key numbers, then (in safe mode) i did a file search and got rid of the files and POOF just like that the virus was dead. Kind of ironic that your name has Angel in it, don’t ya think?lol. Thank you very much.

  18. Roz

    It seems to masquerade as a numbered .exe file in the processes bar of the task manager. Easiest way to confirm it’s what you’re looking for is to type the number into a search on your C: drive. As soon as it came up in the search I recognized the stupid icon (orange striped shield), so I ended the process in the task manager (ignoring the warning), then deleted the two numbered files off the hard drive. Did a reboot and that seemed to fix it. Hope that helps.

    None of the free spyware fixers worked for me either, but this did.

  19. yz

    Thank you so much Angela. You just save my computer.
    The file I catch was 151D1042.exe. Delete it from the C drive and registry then reboot , the fake alert icon from winweb is gone. Thanksssss.

  20. Angela V.

    Thank you Angela!! My process # was different as well but I did exactly as you said and the demon is gone!! NOTHING detected it.

    And hey – can’t go wrong with an Angela ;-)

  21. Jia Wei

    Thanks Angela. I deleted the icon 97996291.exe. It worked!

  22. Al Reeves

    Thanks, you guys especially Angela. It worked.

    Alonzo

  23. Vic

    how do you do a registry search?

  24. siddarth

    Thanks a ton Angela!!

    i have got this 58971888.exe in my machine. I killed the process 58971888 and deleted the file from C:Documents and SettingsAll UsersApplication Data.
    I didn’t find any registry entries though. Feeling good after getting rid of irritating winweb pop ups

  25. EricaLynn

    Angela you are a gift from heaven :) Thank you so much!!!!! You’re a very intelligent woman!!!!

  26. John

    The best way to find this rogue process is to Click on Start…Run, then type MSCONFIG into the box and hit Enter. Click on the Startup tab in the msconfig window and uncheck any item that is being loaded from C:Documents and SettingsAll Users… This is where a lot of spyware hides. When you re-boot the process will not start and you can then delete the associated files from All Users and the Registry.

  27. dominic

    Melissa and Angela are computer wizards! Thank you so much .That Winweb was hiding as numbers.WW is gone now thanks

  28. Vic

    where do you go to get to the Registry

  29. delshawn king

    how do you enter your license key in winweb security window

  30. tay

    how do u do a registry seach plz help??!!!!

  31. fhentom

    omg angela. you’re the angel in my eyes. everything failed to work. but when i followed your steps. it was miraculous. whoa. simple and effective. kudos!

  32. Kat

    Ive got they same prob, i know the 9-digit number and i tried to delete it through the task manager but it only removed it temporarily till you turn the computer back on again.

    I’ve done a search on my computer, C drive and H (for some reason my H drive has all the C drive stuff :S) but it found nothing. So im still stuck with it :(

  33. Kat

    Aha! Just done another scan but this time checked the ‘search hidden folders’ under advanced options and its got it now. Just deleted them so hopefully after this re-boot it’ll be alright, fingers crossed u dont hear from me again!

  34. Deb

    OK, this morning I tried to get rid of the Winweb Security that showed up 2 days ago, by downloading the Malwarebytes above. It did in fact get rid of the Winweb as far as I could tell. Two hours later, while email, my screen starting flashing and now is completely black. No curser. NOthing. Is this something residual from the malware that caused this or a coincidence that it is something else. (I’m on the laptop now tryng to find answers)

  35. david newton

    this program does not work for me. please give me my money back. thankyou

  36. Nadia T

    Do you guys know if I will get my 50 bucks back? I’ve sent 2 emails to them with no response.

  37. Pete

    First I tried Spybot Search & Destroy and Norton to no avail. Spybot found a few files but they weren’t to Winweb Security.

    Then I took Angela’s (#8) advice. It seems to have worked! Before I tried it I called a tech support friend who agreed to try this method but gave me another website in case it didn’t work – which it looks like it did!

    Apparently everyone gets a different 9 or 10 digit number as there .exe file. It sounds like the location it puts this file isn’t the same on every computer.

    After I enabled ‘Show all hidden files and folders’ I found my file (2108770623.exe) at this location:

    C:Documents and SettingsAll UsersApplication Data59184916

    Your file name and location are probably going to be different. Do a Search to find yours.

    At this folder (59184916) there was a Language folder with 3 files in it and another 2 files along side the .exe file.

    I deleted the whole folder (59184916) with the 6 files in it and re-booted. Bye bye @*! Winweb Security spyware program!

    That’s it! Thanks again Angela! You’ve helped a lot of people!!

  38. Rob

    Nadia, i don’t know who you could report it to, but if i was you i wouldn’t even bother trying. it’s a scam that apparently originates from russia, so the chances of you getting your money back are pretty slim, sorry.

  39. Lucky

    Download Zone Alarm ForceField, that way, you’ll never have that problem. Zone Alarm ForceField will take care of that problem. Trust me I tested it, and went there 20 times and it never made it to my computer. (it may apear that it’s getting into your computer and might be scared, but it’s not, Zone Alarm Force Field kills it when you close your browser.

Comments are closed.